Privacy Policy
OllyGarden, Inc. | Last Updated: September 30, 2026
Who we are
OllyGarden, Inc. (“OllyGarden”, “we”) is the controller of the personal data described in this policy. It covers our website at ollygarden.com, the OllyGarden platform at ollygarden.app (including Insights, Rose, and Tulip), and our sales and support communications.
OllyGarden, Inc. is located at 251 Little Falls Drive, Wilmington, DE 19808, United States. Our establishment in the European Union is OllyGarden GmbH, Hauptstr. 14, 13158 Berlin, Germany, which is also our contact point in the EU. See our imprint for company details.
Questions and requests about your personal data can be sent to [email protected].
When customers send us telemetry, source code, or other content to analyze, we process it on their behalf as a processor, under our agreement with that customer and our Data Processing Addendum, which is available on request. The customer's own privacy notice governs that data.
Our website
Visiting the website
- Data
- IP address, browser and device details, requested URL, referrer, and time of the request.
- Purpose
- Delivering the website, keeping it secure, and diagnosing errors.
- Legal basis
- Our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
- Retention
- Hosting logs are kept for the short period our hosting provider retains them.
Website analytics (only with your consent)
- Data
- Pages viewed, clicks on links and buttons, time on page, scroll depth, performance measurements, browser and device type, approximate location derived from your IP address, and the referring site and campaign parameters. We remove URL query strings and fragments, mask page text, and do not record sessions.
- Purpose
- Understanding how the website is used so we can improve it.
- Legal basis
- Your consent (Art. 6(1)(a) GDPR).
- Retention
- Until you withdraw consent, and no longer than needed for trend analysis.
Identifying visiting companies (only with your consent)
- Data
- Your IP address, the pages you visit, the referring site, campaign parameters, and an anonymous identifier stored in your browser. Our provider matches the IP address to the organization that owns the network. We do not use this to identify you as an individual.
- Purpose
- Understanding which organizations are interested in OllyGarden, so our sales team can prioritize follow-up.
- Legal basis
- Your consent (Art. 6(1)(a) GDPR).
- Retention
- Until you withdraw consent, or until the organization-level record is no longer relevant to sales.
Contact, product inquiry, and open source application forms
- Data
- Name, email address, and, depending on the form, company, message, support tier, or GitHub repository URL.
- Purpose
- Responding to your request and evaluating your inquiry or application.
- Legal basis
- Steps you ask us to take before entering a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).
- Retention
- As long as needed to handle your request and any resulting business relationship.
Job applications
- Data
- Full name, email address, and optional LinkedIn and GitHub profile URLs, plus anything you share with us during the hiring process.
- Purpose
- Assessing your application and running our hiring process.
- Legal basis
- Steps prior to entering an employment contract (Art. 6(1)(b) GDPR, § 26 BDSG).
- Retention
- Until the position is filled and the period for legal claims has passed, unless you agree to a longer period.
The OllyGarden platform and our business relationships
Your account
- Data
- Name, email address, authentication identifiers, organization memberships, and sign-in timestamps.
- Purpose
- Creating and securing your account and giving you access to the OllyGarden platform.
- Legal basis
- Performance of our contract with you or your organization (Art. 6(1)(b) GDPR).
- Retention
- For as long as the account exists. Upon deletion, within 30 days, except where the law requires us to keep records.
Product analytics, session recordings, and error monitoring
- Data
- A pseudonymous user identifier, account creation and last sign-in times, pages viewed in the app, errors, browser console messages, and performance measurements. We also record sessions: replays of your interactions with the app, such as clicks, scrolling, and page layout. All text on screen and in form fields is masked in your browser before recordings are sent, so recordings do not contain what you read or type. We remove URL query strings before analytics events are sent.
- Purpose
- Keeping the platform reliable, reproducing and fixing errors, and improving features.
- Legal basis
- Our legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR).
- Retention
- Session recordings are deleted after 90 days. Other analytics data is kept no longer than needed for trend analysis and troubleshooting.
Rose managed repository analysis
- Data
- Repository source code and metadata; file contents, searches, and command output selected during analysis; findings, suggested fixes, execution records, and Rose pull request comments. Operational telemetry can include secret-redacted model and tool inputs and outputs, truncated to 4 KB per item, and therefore code excerpts.
- Purpose
- Analyzing OpenTelemetry instrumentation, presenting findings, preparing proposed fixes for human review, securing and operating Rose, and monitoring quality and reliability.
- Legal basis
- Performance of our contract with you or your organization (Art. 6(1)(b) GDPR) and our legitimate interest in operating a secure and reliable service (Art. 6(1)(f) GDPR).
- Retention
- Full repository checkouts and build artifacts are destroyed with each sandbox. Findings, metadata, execution and follow-up records are kept for the lifetime of the account or until deletion is requested. Rose operational telemetry in Grafana Cloud and Datadog is retained indefinitely and is not removed by deletion requests; telemetry collection can be disabled on request. AI providers may retain prompts and responses for up to 30 days by default. Zero-data-retention routing is available as a separate Enterprise add-on.
Billing
- Data
- Billing contact, company details, and payment information. Our payment provider processes card details; we do not store them.
- Purpose
- Charging for paid plans and meeting accounting obligations.
- Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).
- Retention
- As required by tax and commercial law.
Business contacts and sales outreach
- Data
- Name, business email address, job title, employer, and professional profile information from business databases or from your interactions with us.
- Purpose
- Reaching out to organizations that may benefit from OllyGarden and managing our customer relationships.
- Legal basis
- Our legitimate interest in business-to-business marketing (Art. 6(1)(f) GDPR). You can object at any time and we will stop.
- Retention
- Until you object, or until the contact is no longer relevant to our business.
Cookies and similar technologies
Our website stores your cookie choice in your browser for 12 months. This is strictly necessary and needs no consent.
Analytics and company identification use cookies and browser local storage, and start only after you select Accept analytics. If you choose essential cookies only, neither runs. You can change your choice at any time through Cookie settings in the website footer. Withdrawing consent stops collection from your next page view and clears the related local storage; it does not affect processing that took place before.
The OllyGarden platform uses cookies and local storage that are necessary to sign you in and keep your session secure, and for the product analytics described above.
Who receives your data
We share personal data only with service providers that process it on our behalf and under our instructions and applicable contractual terms:
- • Netlify: Website hosting and delivery
- • Supabase (EU): Storage of website form submissions
- • Resend: Delivery of form submissions to our team by email
- • PostHog (EU): Website analytics
- • Apollo.io: Identification of visiting organizations, business contact data, sales outreach
- • HubSpot: Customer relationship management
- • Google Workspace: Email and documents
The providers that host and operate the OllyGarden platform, including the AI providers that Rose uses, are listed with their purpose and location on our subprocessors page.
We may also disclose personal data where the law requires it, or to protect our rights. We do not sell personal data.
International transfers
Some of our service providers process data in the United States and other countries outside the European Economic Area. By default, the managed Rose service analyzes repositories in E2B's managed United States region and sends selected repository content through OpenRouter to provider-managed OpenAI and Anthropic endpoints. An agreed EU-only Enterprise configuration covers the entire Rose service, including AI processing, managed sandboxes, storage, and telemetry; this is separate from optional zero-data-retention model routing. Our Grafana Cloud monitoring runs in the United Kingdom. For transfers to the United Kingdom we rely on the European Commission's adequacy decision. For other transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR and similar laws, you have the right to:
- • Access the personal data we hold about you and receive a copy
- • Have inaccurate data corrected
- • Have your data deleted
- • Restrict how we process your data
- • Receive your data in a portable format
- • Object to processing based on our legitimate interests, including sales outreach
- • Withdraw your consent at any time
- • Lodge a complaint with a data protection supervisory authority
You can complain to the supervisory authority where you live or work. The authority responsible for our EU establishment is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
To exercise a right, email [email protected]. For deletion, use the subject “Data Deletion Request”. We acknowledge requests within 5 business days, verify your identity before acting, and complete verified requests within 30 days.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Security
We protect personal data with encryption in transit and at rest, access controls, and monitoring. Our Data Protection Policy describes these controls, and our security page explains how to report a vulnerability to [email protected].
Children and changes to this policy
OllyGarden is a business service and is not directed at children under 16. We do not knowingly collect their personal data.
We update this policy when our practices change and show the date of the latest change at the top of this page.